My new guitar
The Stream
Just five days after the release of the XMLHttpRequest Working Draft, today W3C released the first public Working Draft of the Window Object specification. I'm waiting for more, especially the specification for persistent storage on the client.
W3C's first public Working Draft of the XMLHttpRequest Object has been released today.
Part VI
Richard Chu's China - The Middle Kingdom Photo Gallery, Marcos Garcia's Guanxi Photo Gallery, Marcos Garcia's Shanghai Photo Gallery, clr70's Hong Kong Photo Gallery, Alan Clements's Hong Kong Photo Gallery, Kevin Chan's Fantasia Photo Gallery, Marcin Krakowiak's Hangzhou Photo Gallery, Gilbert Ching's Hong Kong Photo Gallery, Jongky Kurniawan's Hong Kong Photo Gallery, Jongky Kurniawan's China Photo Gallery, Echo's Shanghai Photo Gallery, Amazing Grace Photo Gallery.
Things I do, like, use... see my trendy tag cloud. ;-)
To Be or Not to Be... segmentation fault...
Check this out! The Shakespeare Programming Language
Two new album releases in only one week! Today Placebo released their fifth album entitled Meds. I luckily bought it last Friday and I can say it's really good -- well, at the same level as the previous ones. Tracklisting: 1. Meds 2. Infra-red 3. Drag 4. Space Monkey 5. Follow The Cops Back Home 6. Post Blue 7. Because I Want You 8. Blind 9. Pierrot The Clown 10. Broken Promise 11. One Of A Kind 12. In The Cold Light Of Morning 13. Song To Say Goodbye |
Will Google Calendar hit April 1st? Probably yes or close to it. But today's news is that Writely has been acquired by Google. This is interesting, because Sergey Brin recently at the Web 2.0 conference said:
I don't really think that the thing is to take a previous generation of technology and port them directly, and say can we do the minicomuter on the Web on AJAX makes sense. I'm not saying that's what [Microsoft] Office is, I'm just saying that I think the Web and Web 2.0, if that's what you want to call it, gives you the opportunity to do new and better things than the Office package and more. We don't have any plans [to do an office suite].
What will be the next Microsoft move?
...
David Gilmour's new album On an Island... just beautiful! I love it. Tracklisting: 1. Castellorizon 2. On An Island 3. The Blue 4. Take a Breath 5. Red Sky at Night 6. This Heaven 7. Then I Close My Eyes 8. Smile 9. A Pocketful of Stones 10. Where We Start Today it is also David's 60th birthday and I wish him all the best. |
Newsvine Launches!
I have been Newsvine beta tester for two months now and I really like this unique news site. Now it is open to everyone. Read the announcement and try it! It just kicks ass when comparing with other news services.
Opera 9.0 Technology Preview 2 was released today,
3 months after P1, adding some useless stuff and not fixing many
things more important from a web developer's point of view. For
example, they claim having XSLT 1.0 support, but they're lacking
of XSLTProcessor.setParameter()
implementation (its call
always throws NOT_SUPPORTED_ERR
), being important for
many complex web apps. Sigh, I really don't like this browser...
At least, these guys rock as always: Chat + Email = Crazy Delicious.
ROTFL of the Month
<script type="text/javascript"> document.write ('<noscript>alternative content</noscript>'); </script>
Have you ever wondered how
Google tracks
your search result clicks? The technique behind is relatively simple, each
link is attached to the mousedown
event, currently handled by
the rws
function. So your search result links look completely
normal until you press down the mouse button on them. Google rewrites the
URL and redirects through its own website so they are able to track
your choices. For instance, search for Google OS returned
http://www.osnews.com/story.php?news_id=10096 at the third
position, but after the rewrite it became:
I like this elegant solution which is necessary for the Search History and besides it helps Google to better rank the search results.
Netvibes is dangerous
Netvibes is a nice and well designed start page, better than Google's Personal Page and Microsoft's Windows Live. It can be a good application for one who doesn't read more than ten feeds (otherwise a real feed reader is a must-have). In addition to feed reading, they provide some interesting add-ons, like web notes, price watch, To Do list, and mail reading...
Yes, they provide a module for reading a Gmail, Yahoo! Mail, or any other POP3/IMAP4 account. And I find it to be a great danger for anyone who uses it, especially including those hundreds of unaware users.
There are two major issues about it. First of all, in order to use the mail reading module, one must provide login and password. No service should ask one for private passwords to other services. In case of Netvibes, they ask for such a password and do not explicitly state nor describe the further authentication and authorization process. The main problem here is that, at the time of this writing, they only use insecure HTTP protocol instead of encrypted HTTPS!! This means that your mail login and password are being sent over an unencrypted channel between your and Netvibes machine. The simplest solution for this is to just enable HTTPS, but instead they wrote the following in their Terms of service:
- Your use of the Service is at your sole risk.
The service is provided on an "as is" and "as available" basis.
Oh, they just forgot to emphasize "your sole risk" ;).
- You understand that the technical processing
and transmission of the Service, including your Content, may be transfered
unencrypted and involve (a) transmissions over various networks; and (b)
changes to conform and adapt to technical requirements of connecting
networks or devices.
Nope and sorry, but I don't understand why do you send people's passwords over unencrypted channels.
Here is a sample transmission, dumped using Firefox Live HTTP Headers (emphasized text shows the danger):
POST /securePassProxy.php HTTP/1.1
Host: www.netvibes.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.8,pl;q=0.5,uk;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 65
Cookie: ---CENSORED PRIVATE DATA---
Pragma: no-cache
Cache-Control: no-cache
url=https%3A//MyLogin%3AMyPassword@mail.google.com/mail/feed/atom
HTTP/1.x 200 OK
Date: Wed, 04 Jan 2006 20:55:32 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/xml
Secondly, I just don't trust and don't use a service which asks me for my private passwords. Besides the technical danger already explained above, there is a question do they or how they store people's passwords on their machines. This is a proprietary application, thus we don't know their server-side code, but even if we knew, it just wouldn't make much difference. At the time of writing this post, their Privacy Policy says: Netvibes will never sell, rent or share your personal information, especially your e-mail addresses, with any third parties for marketing purposes without your express permission.
Good, they emphasized especially your e-mail addresses , but no explicitly stated about mail logins and passwords. I personally find it more important than the problem of giving my e-mail address to a spammer. Spam is easy to ignore, but what about logging into people's accounts? They already have a nice collection of logins and passwords and almost all mail services do not state the last login time/IP address. So it's fairly easy to read people's mail ;). You can also imagine what could happen if somebody cracked into their machines...
Okay, perhaps I'm just exaggerating the problem and I really, really want to believe that it is not their intention to do such malicious things. I'm sure they just wanted to make people's life easier, but they simply forgot that the risk is *very* high.
Besides these serious flaws, Netvibes is still an interesting service -- just do not use its mail reading modules! :-)
Happy New Year!
I have moved my home page to www.gnu.org.ua/~polak/. Thanks Sergey.
OpenID anyone?
RFC 4287 -- The Atom Syndication Format. So, let's use it!
Yahoo! is catching up Google. After they acquired Flickr and Del.icio.us, now they have opened an interesting Yahoo! Developer Network.
W3C has formed the Web APIs Working Group, as a part of the Rich Web Client Activity for client-side Web Application development. Some interesting to me deliverables are the following:
- An API specification for HTTP functionality.
This generally means standardizing and hopefully improving the XMLHttpRequest interface. The current interface is very limited, imperfect, and yet not widely implemented.
- An API specification for persistent storage on the client.
Cookie is an opaque piece of data held by an intermediary. Cookies are small, maximum 4kB od data per cookie including an opaque string. So of course, retrieving and caching data for rich web clients is currently very difficult and limited. This way it is also impossible for a Web application to work offline. This has to be changed.
- An API specification for drag and drop.
Rich web clients must provide robust, interactive user interfaces. Drag and drop is a common mechanism used on desktops everywhere. Implementing it in Web application is nowadays tricky and requires a master knowledge of JavaScript, DOM, and CSS.
Other interesting areas:
- An API specification for a client interface (the Window object).
- The DOM Level 3 Events specification (in coordination with a future DOM IG/WG).
- An API specification for timed events.
- API specifications for other network communication methods.
- The DOM Level 3 XPath specification (in coordination with the DOM IG/WG).
- An API specification for monitoring the progress of resources as they are downloaded.
- An API specification for file upload.